mainGnuTLS - Support: sr #108090, Unable to decode PKCS12 with NULL...

 
 

sr #108090: Unable to decode PKCS12 with NULL password since 3.0.20

Submitter:  Alexandre Chataignon <xouillet>
Submitted:  Wed 18 Jul 2012 04:56:59 PM UTC
   
 
Category:  Core library Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  nmav
Open/Closed:  Closed Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Tue 14 Aug 2012 01:12:03 PM UTC, comment #7: 

Sorry, didn't see it was included in 3.0.22, thank you very much

Alexandre Chataignon <xouillet>
Tue 14 Aug 2012 01:08:33 PM UTC, comment #6: 

I have attached the file since July 26, have you stated on the problem ?

Alexandre Chataignon <xouillet>
Fri 20 Jul 2012 07:26:25 AM UTC, comment #5: 

Could you attach a PKCS #12 file encrypted with NULL in this bug report for testing?

Anonymous
Thu 19 Jul 2012 10:24:39 PM UTC, comment #4: 


> Did you try specifying a password containing the null string (not NULL), and a password size of zero?


Yes, It doesn't work

> btw. How do you generate and/or decrypt those keys of yours from the openssl command line applications?


I'm not sure it's possible to generate those keys from the command line, but it is definitely possible to decrypt them with the "" password

Alexandre Chataignon <xouillet>
Thu 19 Jul 2012 10:09:33 PM UTC, comment #3: 

Did you try specifying a password containing the null string (not NULL), and a password size of zero?

btw. How do you generate and/or decrypt those keys of yours from the openssl command line applications?


Nikos Mavrogiannopoulos <nmav>
Group administrator
Thu 19 Jul 2012 09:32:35 PM UTC, comment #2: 

Actually, I have generated a batch of pkcs12 certificates with a python snippet similar to the one I have posted without asking me too much questions. I mean, it uses openssl api in its simplest form, the generated pkcs12 works fine with openssl itself, but also in OpenVPN for example. It's impossible for me to regenerate all the certificates, so yes, I would like backwards compatibility.

I don't know the right behavior, but the fact that it used to work in gnutls and that it works in OpenSSL makes me think that's a regression.

> Do you see difference in the key generated from "" with 0 size, and NULL with 0 size?


Ahem, I don't understand the question, can you describe please ?

Alexandre Chataignon <xouillet>
Thu 19 Jul 2012 08:15:10 PM UTC, comment #1: 

I'm not sure if it is the right behavior to accept such keys. Is there a reason you use them and do not use unencrypted keys or is it a bug that you want to keep backwards compatibility with?

Do you see difference in the key generated from "" with 0 size, and NULL with 0 size?

Nikos Mavrogiannopoulos <nmav>
Group administrator
Wed 18 Jul 2012 04:56:59 PM UTC, original submission:  

Since gnutls 3.0.20, decoding of PKCS12 with a NULL password (NULL, not "") is impossible.

For example this line used to work in gnutls-3.0.19 :
ret = gnutls_certificate_set_x509_simple_pkcs12_file(xcred, pkcs12_f, GNUTLS_X509_FMT_DER, NULL) ;

The problem comes from line :
lib/x509/privkey_pkcs8.c:1231:  if (password == NULL || (flags & GNUTLS_PKCS_PLAIN))

that used to be
lib/x509/privkey_pkcs8.c:1231:  if (flags & GNUTLS_PKCS_PLAIN)

PKCS12 file with NULL password can be easily generated via openssl library, for example with this python snippet :

  from OpenSSL import crypto
  key  = crypto.load_privatekey(crypto.FILETYPE_PEM,  open("mycert.key").read())
  cert = crypto.load_certificate(crypto.FILETYPE_PEM, open("mycert.crt").read())

  p12 = crypto.PKCS12()
  p12.set_certificate(cert)
  p12.set_privatekey(key)
  open("test.p12",'w').write(p12.export())

Alexandre Chataignon <xouillet>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #26260:  test.p12 added by xouillet (2KiB - application/x-pkcs12 - Example P12 file with NULL password)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by xouillet (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2012-09-03 nmav StatusNeed Info Done
        Open/ClosedOpen Closed
    2012-07-26 xouillet Attached File- Added test.p12, #26260
    2012-07-19 nmav StatusNone Need Info
        Assigned toNone nmav

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code